RADIUS Attribute-Value Pairs

Cisco Secure ACS 2.4 for Windows NT Server (CiscoSecure ACS) provides support for many Remote Access Dial-In User Service (RADIUS) attribute-value (AV) pairs. CiscoSecure ACS includes the full AV pairs contained in Cisco IOS Release 12.0, Ascend, and Internet Engineering Task Force (IETF) RADIUS. You can enable different AV pairs for any of the supported vendors. The supported RADIUS AV pairs specific to each vendor are listed in this appendix.

Before selecting AV pairs for the CiscoSecure ACS, confirm that your network access server (NAS) is running a compatible release of Cisco IOS or compatible NAS software. See the "System Requirements" section for more information.

Note If you specify a given AV pair on the CiscoSecure ACS, the corresponding AV pair must be implemented in the Cisco IOS software running on the NAS. Always take into consideration which AV pairs your Cisco IOS release supports on the NAS. If CiscoSecure ACS sends an AV pair that the Cisco IOS software does not support to the NAS, the attribute is not implemented.
Note Beginning with CiscoSecure ACS Release 2.3, some RADIUS attributes do not appear on the Group Setup page. This is because IP pools and Callback supersede the following attributes:8, Framed-IP-Address
19, Callback-Number
218, Ascend-Assign-IP-PoolAdditionally, these attributes cannot be set via RDBMS Synchronization.

Table D-3 lists the supported RADIUS (IETF) attributes. If the attribute has a security server-specific format, the format is specified. Note that accounting attributes are listed in a separate table, Table D-4.

Physical port number of the NAS that is authenticating the user. The NAS port value (32 bits) consists of one or two 16-bit values, depending on the setting of the RADIUS server extended portnames command. Each 16-bit number is a 5-digit decimal integer interpreted as follows:

For asynchronous terminal lines, async network interfaces, and virtual async interfaces, the value is00ttt, where ttt is the line number or async interface unit number.

IP netmask to be configured for the user when the user is a router to a network. This attribute-value results in a static route being added for Framed-IP-Address with the mask specified.

10

Framed-Routing

Routing method for the user when the user is a router to a network. Only None and Send and Listen values are supported for this attribute.

11

Filter-Id

Name of the filter list for the user, formatted as follows: %d, %d.in, or %d.out. This attribute is associated with the most recent service-type command. For login and EXEC, use %d or %d.out as the line access list value from 0 to 199. For Framed service, use %d or %d.out as interface output access list and %d.in for input access list. The numbers are self-encoding to the protocol to which they refer.

12

Framed-MTU

Indicates the maximum transmission unit (MTU) that can be configured for the user when the MTU is not negotiated by PPP or some other means.

13

Framed-Compression

Compression protocol used for the link. This attribute results in "/compress" being added to the PPP or SLIP autocommand generated during EXEC authorization. Not currently implemented for non-EXEC authorization.

14

Login-IP-Host

Host to which the user will connect when the Login-Service attribute is included.

15

Login-Service

Service that should be used to connect the user to the login host.

Service is indicated by a numeric value as follows:

0: Telnet

1: Rlogin

2: TCP-Clear

3: PortMaster

4: LAT

16

Login-TCP-Port

TCP5 port with which the user is to be connected when the Login-Service attribute is also present.

18

Reply-Message

Text to be displayed to the user.

22

Framed-Route

Routing information to be configured for the user on this NAS. The RADIUS RFC6 format (net/bits [router [metric]]) and the old style dotted mask (net mask [router [metric]]) are supported. If the router field is omitted or 0, the peer IP address is used. Metrics are currently ignored.

24

State

Allows State information to be maintained between the NAS and the RADIUS server. This attribute is applicable only to CHAP challenges.

26

Vendor-Specific

Allows vendors to support their own extended attributes. The Cisco RADIUS implementation supports one vendor-specific option using the format recommended in the specification. Cisco's vendor-ID is 9, and the supported option is vendor-type 1, cisco-avpair. The value is a string of the format:

protocol:attribute sep value

Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value are an appropriate AV pair defined in the Cisco TACACS+ specification, and "sep" is "=" for mandatory attributes and "*" for optional attributes. This allows the full set of TACACS+ authorization features to be used for RADIUS. For example:

cisco-avpair= "ip:addr-pool=first"
cisco-avpair= "shell:priv-lvl=15"

The first example causes Cisco's multiple named IP address pools feature to be activated during IP authorization (during PPP's IPCP address assignment). The second example causes a NAS prompt user to have immediate access to EXEC commands.

27

Session-Timeout

Maximum number of seconds of service to be provided to the user before the session terminates. This attribute value becomes the per-user absolute timeout. This attribute is not valid for PPP sessions.

28

Idle-Timeout

Maximum number of consecutive seconds of idle connection time allowed to the user before the session terminates. This attribute value becomes the per-user session-timeout. This attribute is not valid for PPP sessions.

34

Login-LAT-Service

System with which the user is to be connected by LAT. This attribute is only available in the EXEC mode.

61

NAS-Port-Type

Indicates the type of physical port the network access server is using to authenticate the user. Physical ports are indicated by a numeric value as follows:

0: Asynchronous

1: Synchronous

2: ISDN-Synchronous

3: ISDN-Asynchronous (V.120)

4: ISDN- Asynchronous (V.110)

5: Virtual

62

Port-Limit

Sets the maximum number of ports to be provided to the user by the network access server.

Arbitrary value that the NAS includes in all accounting packets for this user if supplied by the RADIUS server.

30

Called-Station-Id

Allows the NAS to send the telephone number the user called into as part of the access-request packet (using DNIS1 or similar technology). This attribute is only supported on ISDN and for modem calls on the Cisco AS5200 if used with PRI2.

31

Calling-Station-Id

Allows the NAS to send the telephone number the call came from as part of the access-request packet using automatic number identification or similar technology. This attribute has the same value as remote-addr in TACACS+. This attribute is supported only on ISDN and for modem calls on the Cisco AS5200 if used with PRI.

40

Acct-Status-Type

Specifies whether this accounting-request marks the beginning of the user service (start) or the end (stop).

41

Acct-Delay-Time

Number of seconds the client has been trying to send a particular record.

42

Acct-Input-Octets

Number of octets received from the port while this service is being provided.

43

Acct-Output-Octets

Number of octets sent to the port while this service is being delivered.

44

Acct-Session-Id

Unique accounting identifier that makes it easy to match start and stop records in a log file. The Acct-Session Id restarts at 1 each time the router is power cycled or the software is reloaded. Contact Cisco support if this is unsuitable.

45

Acct-Authentic

Way in which the user was authenticated---by RADIUS, by the NAS itself, or by another remote authentication protocol. This attribute is set to radius for users authenticated by RADIUS; to remote for TACACS+ and Kerberos; or to local for local, enable, line, and if-needed methods. For all other methods, the attribute is omitted.

46

Acct-Session-Time

Number of seconds the user has been receiving service.

47

Acct-Input-Packets

Number of packets received from the port while this service is being provided to a framed user.

48

Acct-Output-Packets

Number of packets sent to the port while this service is being delivered to a framed user.

49

Acct-Terminate-Cause

Reports details on why the connection was terminated. Termination causes are indicated by a numeric value as follows:

Table D-5 contains Ascend RADIUS dictionary translations for parsing requests and generating responses. All transactions are composed of AV pairs. The value of each attribute is specified as one of the following valid data types:

string---0-253 octets

abinary---0-254 octets

ipaddr---4 octets in network byte order

integer---32-bit value in big endian order (high byte first)

call filter---defines a call filter for the profile

Note RADIUS filters are retrieved only when a call is placed using a RADIUS outgoing profile or answered using a RADIUS incoming profile. Filter entries are applied in the order in which they are entered. If you make changes to a filter in an Ascend RADIUS profile, the changes do not take effect until a call uses that profile.